ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-37168 CVE-2024-37168 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2024-37168 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +248 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.28 and more Source cves: CVE-2026-101916 Source advisory: OSV:GHSA-M9GG-HP2V-232J...

EUVD-2026-88476

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8528 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101916 Source advisory: OSV:GHSA-M9GG-HP2V-232J...

GHSA-M9GG-HP2V-232J @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

EUVD-2026-88468

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8528 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101915 Source advisory: OSV:GHSA-F596-WHHP-79R4...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +248 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.28 and more Source cves: CVE-2026-101915 Source advisory: OSV:GHSA-F596-WHHP-79R4...

GHSA-F596-WHHP-79R4 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers. Patches This vulnerability is...

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Impact If an application method handler crashes, the error message is included in the status message sent to the client. This can leak to the client any sensitive data that may be included in the error message. This impacts anyone using @grpc/grpc-js to run servers. Patches This vulnerability is...

CVE-2026-101916

A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing th...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8528 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101915 Source advisory: SNYK:JS-GRPCGRPCJS-20251007...

Server-generated Error Message Containing Sensitive Information

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +248 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.28 and more Source cves: CVE-2026-101915 Source advisory: SNYK:JS-GRPCGRPCJS-20251007...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +248 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.28 and more Source cves: CVE-2026-101916 Source advisory: SNYK:JS-GRPCGRPCJS-20251010...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8528 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101916 Source advisory: SNYK:JS-GRPCGRPCJS-20251010...